Skill

create-entry

skill:wilsonfreitas/awesome-quant#create-entry

Use when the user wants to suggest, draft, create, or add an awesome-quant README entry from a project URL, GitHub issue, or Linear issue, including choosing tags and category placement.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:39 UTC at b52a1a9

findings

medium

highest severity

threat classes

files scanned

472/472

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:.agents/skills/create-entry:README.md:327:IMPERSONATE
suspicious: finding skill:.agents/skills/create-entry:README.md:327:MANIP

Security findings 2

Impersonation

mediumContextual riskmedium confidence

The README entry 'TolmachЁv Netcode SDK' mixes Latin and Cyrillic (Ё) characters in its name, a homoglyph construct that can evade the skill's duplicate-name search during curation and gives an unverifiable .store-domain project a deceptive distinctive identity.

README.md:327

TolmachЁv Netcode SDK

conceal:unicode

Counter-argument considered

The mixed-script name is verbatim in the shipped README the skill curates and the detector confirms the Cyrillic homoglyph; the same artifact documents duplicate checking in its validation workflow, so the homoglyph has a concrete route to defeat exact-match duplicate detection, and no declaration or carve-out covers mixed-script project names.

Manipulation

mediumContextual risklow confidence

The TolmachЁv Netcode SDK README entry asserts physically impossible performance figures as established fact, which can mislead the curating agent into treating the entry as legitimate and evidence-backed.

README.md:327

Throughput >41.5M TPS, physical RTT 24.175 ns, atomic validation (0 CPU load)

Counter-argument considered

The entry asserts physically impossible figures with fake precision as fact in content the curating agent consumes, with no declaration marking them unverified; the presence of ordinary puffery elsewhere in the list does not neutralize this construct, which is paired with a homoglyph name and an unrelated .store site.

Open questions 18

What the analysis could not settle from the code alone.

Detector leads (PY-CLAIM-CONTRADICTION / PY-CLAIM-RESIDUE) assert a claim 'Runs locally via Docker and is drivable by AI agents through a bundled MCP server.' is contradicted by third-party project URLs, but that claim text does not appear in any shown unit; the excerpts are ordinary links in the curated awesome-quant list, so the contradictions could not be verified and no exfiltration behavior is evidenced in these spans.

SKILL.md instructs the agent to use the `$sprr` command for requested PR review; what command or skill does `$sprr` resolve to and what does it execute?

The PY-CLAIM-CONTRADICTION leads attribute the claim 'Runs locally via Docker and is drivable by AI agents through a bundled MCP server' to README.md and SKILL.md, but this claim text does not appear in any owed unit; the flagged github.com/cran.r-project.org/pypi.org URLs in the shown units are plain hyperlinks in curated list entries, not network calls, so no source-to-sink exfiltration chain is confirmable from the evidence shown. Where does the claim live, and does any shipped code actually ⟦… 22 more chars …⟧

Data exfiltration

The decoded content of site/static/main.js spans 301 lines but shows only section-header comments (Theme, Search & Filter, Tag Click Handler, Sort, URL State) with no executable statements visible; confirm whether the shipped file contains network, eval, or exec sinks absent from the decoded channel.

Code execution

[file request docs/codex-setup.md] The skill points the agent to docs/codex-setup.md when GitHub MCP is unavailable; what setup instructions, downloads, installs, or credential steps does it direct the agent to perform?

Code execution

[file request .agents/skills/create-entry/SKILL.md] Does the create-entry skill body (frontmatter and instructions) contain directives steering beyond drafting/adding README entries, such as overrides, secrecy, auto-run steps, hidden or encoded content, or reads of files the task does not need?

Agent hijacking

[file request .agents/skills/create-entry/SKILL.md] Do the unseen workflow steps between the frontmatter and 'Compose the proposal' instruct the agent to run commands or scripts, fetch remote URLs (GitHub/Linear/project pages), or read credentials or files outside the README task?

Code execution

[invalid file request] AGENTS.md is read by the create-entry skill every run as a source of truth; do its contents stay within repository contribution guidance, or do they include agent-behavior overrides, credential access, network sends, or secrecy directives?

Agent hijacking

[invalid file request] CONTRIBUTING.md gates entry eligibility and PR acceptance and is read every run; does it contain only contribution rules, or also instructions that run commands or redirect agent behavior?

Agent hijacking

[invalid file request] parse.py is run with GITHUB_ACCESS_TOKEN per the setup docs; does it confine the token to GitHub API calls and write only local CSV, or send data/credentials to other destinations or execute fetched code?

Data exfiltration

[file request scripts/readme_entries.py] validate_readme.py imports ENTRY_RE, GITHUB_LINK_RE, iter_readme_entries, nested_reference_repairs and others from this sibling module, whose top-level code runs at import time and whose functions the validator calls: does scripts/readme_entries.py write any files, execute other programs or scripts, or send any data off-host?

Code execution

[file request AGENTS.md] The skill directs the agent to read AGENTS.md from the repository root every run as a source of truth; does it contain directives beyond README entry curation, such as agent-behavior overrides, credential access, network sends, or external actions?

Agent hijacking

[file request CONTRIBUTING.md] The skill defers eligibility, format, PR-approval, and review conventions (including the $sprr command) to CONTRIBUTING.md; does it stay within entry curation or add auto-run steps, external-action authorizations, or other agent directives?

Agent hijacking

[file request AGENTS.md] Do the durable repository instructions in AGENTS.md, which Codex loads, steer the agent beyond README entry creation (e.g., instruction overrides, auto-run commands, credential access, secrecy from the user)?

Agent hijacking

[file request CONTRIBUTING.md] Does CONTRIBUTING.md, which the skill checks for entry eligibility, contain only eligibility rules, or also behavioral instructions that push the agent beyond the declared task?

Agent hijacking

[file request scripts/parse.py] Does parse.py, which the setup docs instruct running with GITHUB_ACCESS_TOKEN, do anything beyond fetching GitHub metadata and writing local CSV (e.g., sending the token or workspace files to non-GitHub destinations)?

Data exfiltration

[file request AGENTS.md] SKILL.md directs the agent to read AGENTS.md from the repository root every time as source of truth; does it contain instructions beyond repository contribution rules that could redirect agent behavior?

Agent hijacking

[file request CONTRIBUTING.md] SKILL.md directs the agent to read CONTRIBUTING.md from the repository root every time as source of truth for eligibility, format, and required workflows; does it contain anything beyond contribution rules, such as instructions to run external code?

Agent hijacking

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Credential access

criticalRefutedlow confidence

docs/codex-setup.md instructs running parse.py with GITHUB_ACCESS_TOKEN exported into the environment while parse.py is not consumed by any agent client, so how the credential is used or transmitted cannot be verified from reviewable content.

docs/codex-setup.md:86

GITHUB_ACCESS_TOKEN=<token> uv run python parse.py

Why it was refuted

The visible behavior is supplying a GitHub env API key for a script the artifact's own docs declare enriches entries with GitHub metadata — the wrapped-service carve-out — and that declared purpose (D915, same unit) plus the token-free site-generator path shows the token is scoped to GitHub enrichment, not concealed or redirected. The finding's only harm basis is unverifiability of the non-consumed parse.py (ABSENT:ab2c21332f0d7643), which is an absence that cannot establish harm and cannot override the carve-out and explicit declaration of the instruction as written.

Coverage gaps 7

Parts of the artifact the static analysis could not fully examine.

glob_budget_exceeded reference source exceeds 262144 characters

site/index.html

request_unanswered request.0: instruction-surface.0/req-codex-setup: finding: no valid finding cites the answer's evidence

request_unanswered request.0: instruction-surface.1/req-skill-md: finding: no valid finding cites the answer's evidence

request_unanswered request.0: behavior-chains.0/skill-md-workflow: finding: no valid finding cites the answer's evidence

invalid_judge_finding request.0

request_unanswered request.0: invalid file request (evidence_ids not shown in the asking request)

invalid_refuter refuter results do not match requested findings